It's not actually reduced to one factor, just a single point of failure. If their password manager gets taken it's a problem, however the generated TOTP is worthless in 1 min. So this will protect the login from cases where the password is known like a compromised website or a reused password.

[–] TheObviousSolution@lemmy.ca 2 points 7 hours ago* (last edited 7 hours ago) (1 children)

If the site is compromised, then the hackers could have stolen the TOTP secrets as well as the passwords. How do you think the site verifies TOTP codes? If you reuse passwords while using a password manager, you are asking for it, though.

[–] Fiery@lemmy.dbzer0.com 1 points 6 hours ago* (last edited 6 hours ago) (1 children)

A full hack of every part of the service is not the only way a user's password could get known to an attacker. Could be MiTM, could be typo-squatted, etc

If a site is that compromised no measure of auth is gonna help, so little use worrying about it.

[–] TheObviousSolution@lemmy.ca 1 points 6 hours ago* (last edited 6 hours ago)

A lot of the technology you use to connect over VPNs or over the Internet already addresses MitM. If it's typo-squatted, you are sort of using password managers wrong. You do have the option of setting up TOTP elsewhere like on your phone authenticator so the point of failure isn't on your side, I just think it's sort of funny how easily you can make it be one.

[–] Coleslaw4145@lemmy.world 0 points 9 hours ago* (last edited 9 hours ago) (2 children)

But if a password manager is compromised then doesn't the attacker also get the TOTP key which is what generates the codes in the first place?

It wouldn't matter if it expires in one minute because they'll have the token to generate the next code, as well as now knowing the password.

[–] JcbAzPx@lemmy.world 1 points 5 hours ago

That depends on the manager. Good ones won't have access to your stuff outside of an encrypted blob. Still, it's generally better to use a separate authenticator.

[–] Fiery@lemmy.dbzer0.com 4 points 9 hours ago (1 children)

That makes it a single point of failure yes, and the rest of the comment you're replying to goes into detail on what it does protect from even if both passwd and TOTP are in the password manager

[–] Coleslaw4145@lemmy.world 2 points 8 hours ago

Sorry i misunderstood what you were saying. I thought you were saying that if the password manager was compromised then the attackers would have only 1 minute to make use of the tokens before they change.